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Abstract. The paper presents the first nontrivial upper and lower bounds for (non- 
oblivious) quantum read-once branching programs. It is shown that the computational 
power of quantum and classical read-once branching programs is incomparable in the 
following sense: 

(i) A simple, explicit boolean function on 2n input bits is presented that is computable 
by error-free quantum read-once branching programs of size O (n 3 ) , while each classical 
randomized read-once branching program and each quantum OBDD for this function 
with bounded two-sided error requires size 2 n( - n \ 

(ii) Quantum branching programs reading each input variable exactly once are shown to 
require size 2 n ^ for computing the set-disjointness function DISJ n from communication 
complexity theory with two-sided error bounded by a constant smaller than 1/2 — 2^/3/7. 
This function is trivially computable even by deterministic OBDDs of linear size. 

The technically most involved part is the proof of the lower bound in (ii). For this, a new 
model of quantum multi-partition communication protocols is introduced and a suitable 
extension of the information cost technique of Jain, Radhakrishnan, and Sen (2003) to 
this model is presented. 

1. Introduction 

This paper deals with the space complexity of sequential, nonuniform quantum algo- 
rithms, modeled by quantum branching programs. It follows the general plan of devel- 
oping lower bound techniques for gradually less restricted variants of the model. This 
line of research is well motivated by the fact that, in the classical case, it has already 
led to practically meaningful time-space tradeoff lower bounds for general randomized 
branching programs solving decision problems jUEHH]. 

Lower bounds and separation results generally come in two main flavors: results for 
multi-output-bit functions and for single-output-bit functions or decision problems. Of 
the former type are recent time-space tradeoffs for quantum circuits computing some 
practically important functions, including sorting [T6tlT|l20] and boolean matrix-vector 
and matrix-matrix multiplication [2T)|ll7j. 
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Here we are concerned with lower bounds and separation results for decision problems, 
which are usually harder to obtain than for multi-output-bit problems in the same model. 
Such results have been proved for the uniform model of quantum finite automata (QFAs, 
see, e.g., [2*T)l25| lo]). On the nonuniform side, general quantum branching programs 
and quantum OBDDs (ordered binary decision diagrams) have been considered (see the 
next section for an introduction of these models). Extending independently obtained 
results by Spalek [SSI, ^ has been shown in [31] that the logarithm of the size of general 
quantum branching programs captures the space complexity of nonuniform quantum 
Turing machines. Ablayev, Moore, and Pollett [3] have proved that NC 1 is included in the 
class of functions that can be exactly computed by quantum oblivious width-2 branching 
programs of polynomial size, in contrast to the classical case where width 5 is necessary 
unless NC 1 = ACC. Furthermore, exponential gaps have been established between the 
width of quantum OBDDs and classical deterministic OBDDs (Ablayev, Gainutdinova, 
and Karpinski [2]) and classical randomized OBDDs, resp. (Nakanishi, Hamaguchi, and 
Kashiwabara j2S])- Finally, it has been shown in [31] that the classes of functions with 
polynomial size quantum OBDDs and deterministic OBDDs are incomparable and an 
example of a partially defined function for which quantum OBDDs are exponentially 
smaller than classical randomized ones has been presented. 

Proving lower bounds on the space complexity of quantum algorithms for models that 
are more general than QFAs or quantum OBDDs and solve explicit decision problems 
has been open so far. In particular, previous results in this context have been limited to 
models that are oblivious, i. e., are required to read their input bits in a fixed order. Here 
we consider the non-oblivious model of quantum read-once branching programs, which 
are quantum branching programs that during each computation may access each input 
bit at most once. The logarithm of the size of quantum read-once branching programs is 
a lower bound on the space-complexity of (uniform or nonuniform) quantum read-once 
Turing machines. This follows by an easy adaptation of the proof in [3I| for general 
quantum branching programs. On the other hand, all upper bounds presented here in 
terms of quantum read-once branching programs can easily be modified to work also for 
(uniform or nonuniform) quantum read-once Turing machines. 

We prove the first nontrivial upper and lower bounds for quantum read-once branching 
programs. As our first main result, we present a simple function for which quantum 
read-once branching programs are exponentially smaller than classical randomized ones. 
This result is even for a total function (compare this to the fact that analogous results for 
quantum OBDDs [31] and quantum one-way communication complexity S\ known so far 
are only for partially defined functions). We use the weighted sum function due to Savicky 
and Zak [32j as a building block. For a positive integer n and x — (xi, . . . , x n ) G {0, l} n , 
let p(n) be the smallest prime larger than n and let s n (x) = (X)ILi i' x i) modp(n). Define 
the weighted sum function by WS n (x) = x Sn r x ) if s n (x) G {1, . . . , n} and otherwise. For 
a further input vector y = (yi, . . . , y n ) G {0, l} n define the mixed weighted sum function 
by MWS n (x, y) = XiQyi if i — s n (x) = s n (y) G {1, . . . , n} and otherwise. 

Theorem 1. Each randomized read-once branching program and each quantum OBDD 
computing MWS n with two-sided error bounded by an arbitrary constant smaller than 1/2 
requires size 2 n<yTl \ while MWS„ can be computed by an error-free quantum read-once 
branching program of size O (n 3 ) . 
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The above result shows that being able to choose different variable orders for differ- 
ent inputs may help a lot for quantum read-once algorithms, even compared to classi- 
cal randomized read-once algorithms that are allowed the same option. On the other 
hand, combining the read-once property with the usual unitarity constraint for quan- 
tum algorithms (required by physics) can also turn out to be a severe restriction on 
the computing power. It has already been shown in that quantum OBDDs for 
the set-disjointness function DISJ n from communication complexity theory, defined by 
DISJ n (x, y) = -i(x 1 y 1 V • • • V x n y n ) for x = (x x , . . . , x n ), y = (y 1 ,...,y n ) G {0, 1}™, re- 
quire size 2 n ( n \ As our second main result, we prove a lower bound of the same order 
even for the non-oblivious case. We need the additional assumption here that the branch- 
ing programs do not only read each input variable at most once, but even exactly once. 

Theorem 2. Each quantum branching program that reads each input variable exactly 
once and computes DISJ„ with two-sided error bounded by a constant smaller than 1/2 — 
2V3/7 (» 0.005) has size 2 n ^ . 

Note that DISJ n can be trivially computed by deterministic OBDDs of linear size. With 
the usual "uncomputing" trick it is also easy to construct a reversible (and thus quantum) 
oblivious read-twice branching program of linear size for this function. 

The proof of the above lower bound is considerably more involved and uses a more 
advanced technique than that for quantum OBDDs in |31j . although both rely on argu- 
ments from information theory. We use the general information-theoretical framework 
that Bar-Yossef, Jayram, Kumar, and Sivakumar [Z| have developed for classical random- 
ized communication complexity and that they have applied, among other results, for an 
elegant new proof of a linear lower bound for the disjointness function. Furthermore, we 
exploit main ideas from the recent extension to the quantum case for a bounded number 
of rounds due to Jain, Radhakrishnan, and Sen [TBI IX^] , who in turn relied on technical 
tools due to Klauck, Nayak, Ta-Shma, and Zuckerman [T8|IT9] . For formalizing the proof, 
we introduce a new model of quantum (one-way) multi-partition protocols that allows 
protocols to use more than one input partition and may be interesting for its own sake. 
(See [12] for a nondeterministic, classical variant of this model.) The core part of the 
proof is a lower bound of f2(l) on the information cost of quantum multi-partition pro- 
tocols computing the AND of two bits. This complements a similar bound due to Jain, 
Radhakrishnan, and Sen that only works for a single input partition, but for any constant 
number of rounds instead of only one round here. 

It remains open whether the lower bound in Theorem El remains true for quantum read- 
once branching programs that are not forced to read each variable at least once during 
any computation. It is easy to enforce this property for classical read-once branching 
programs while maintaining polynomial size, but it is not clear how to do this in the 
quantum case due to the required unidirectionality of the programs (see the next section). 

The rest of the paper is organized in the obvious way: In the next section, we define the 
variants of quantum branching programs considered here. In two further sections, we 
present the proofs of the main results. 
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2. Preliminaries 

We assume a general background on quantum computing and quantum information the- 
ory (as provided, e.g., by the textbook of Nielsen and Chuang |2Zj) and on classical 
branching programs (BPs) (see, e.g., the textbook of Wegener |36j). We start with the 
definition of general quantum branching programs. 

Definition 1. A quantum branching program (QBP) over the variable set X = 
{xi,...,x n } is a directed multigraph G = (V,E) with a start node s G V and a set 
F C V of sinks. Each node v G V — F is labeled by a variable ^61 and we define 
var(w) = i. Each node v G F carries a label from {0,1}, denoted by label(f). Each 
edge (v,w) G E is labeled by a boolean constant 6 G {0,1} and a (transition) ampli- 
tude 8(v,w,b) G C. We assume that there is at most one edge carrying the same boolean 
label between a pair of nodes and set 8(v, w, b) = for all (v, w) G" E and b G {0, 1}. 

The graph G is required to satisfy the following two constraints. First, it has to be 
well-formed, meaning that for each pair of nodes u, v G V — F and all assignments 
a = (ai, . . . , a n ) to the variables in X, Y,wev w ' a var( u ))<$(v, w > a ™r(v)) = 1 if u = v 
and otherwise. Second, G has to be unidirectional, which means that for each w G V, 
all nodes v G V such that 8(v,w,b) ^ for some b G {0,1} are labeled by the same 
variable. 

A computational state of the QBP is a pure quantum state over the Hilbert space TC = 
C' v ' spanned by an ON-basis (\v)) v€ y The computation for an input a = (a%, . . . ,a n ) 
starts with the computational state \s), called initial state. Let the QBP be in the 
computational state \ip) = ^ veV at v \v) G TC at the beginning of a computation step. 
Then the QBP first carries out a projective measurement of the output label at the nodes 
in |^). This yields the result r G {0,1} with probability J2 v &f iabei(i>)=r \ a v \ 2 - If one 
of these events occurs, the respective output is produced and the computation stops. 
The computation carries on for the non-sink nodes with nonzero amplitude in Let 
l^') = J2vev-F a v\ v ) be the state obtained by projecting to the subspace spanned by 
the non-sink nodes and renormalizing. Then the next computational state is defined as 

W) = J2v£V-F a 'vl2 W £V S ( V ' W ' a ™(v))H- 

The probability that G outputs r e {0,1} on input a G {0, 1}™ is defined as the sum of the 
probabilities of obtaining the output r after any finite number of steps. Let G(a) be the 
random variable describing the output of G on input a, called the output random variable 
of G for a. We say that the function /: {0, l} n — > {0, 1} defined on X is computed by G 

• with two-sided error at most e, < e < 1/2, if for each a G {0, l} n , Pr{G(a) ^ 
f( a )} < an d it is computed 

• exactly (or G is an error-free QBP for /), if for each a G {0, 1}™, Pr{G(a) ^ f{a)} = 0. 

Furthermore, by bounded two-sided error we mean two-sided error with some unspecified 
constant bound e. (Other modes of acceptance may be defined as usual for other quantum 
models of computation.) 

The size of a QBP G is the number of its nodes and is denoted by \G\. Its width is the 
maximum number of nodes with the same distance from the start node. 
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The definition of QBPs is similar to that of the uniform models of quantum finite au- 
tomata (QFAs) and quantum Turing machines (QTMs), whose relationships to the re- 
spective classical models have already been studied to a considerable extent (see, e.g., 
[HJ|23iniEnilHllES] ) ■ A strong motivation why QBPs are a natural model is provided by 
the fact that the logarithm of their size and the space complexity for nonuniform QTMs 
are polynomially related [33|l3"T] . For the scenario of sublinear space bounds, it has turned 
out to be useful to work with unidirectional QTMs, i. e., QTMs whose directions of head 
movements depend only on the entered state of the finite control. This is the standard 
model in the papers of Watrous [HUES] and also that used for the simulation between 
QBPs and QTMs in |3*3*l l31|. The unidirectionality constraint for QBPs (called parental 
condition in [S3]) turns up as a natural counterpart of that for QTMs required to make 
the simulations work. In order to prevent QBPs from being unreasonably powerful, it is 
further realistic to restrict the set of allowed amplitudes, see also [SI]. This is no issue 
here, since the upper bounds in the paper only use amplitudes from {0, 1, ±1/2} and the 
lower bounds for QBPs are valid for arbitrary complex amplitudes. 

For the construction of QBPs it is sometimes convenient to use unlabeled nodes with an 
arbitrary number of outgoing edges carrying only amplitude labels. An unlabeled node v 
can be regarded as an abbreviation for a node according to the standard definition labeled 
by a dummy variable on which the considered function does not depend. Each edge 
leading from the unlabeled node v to a successor w with amplitude a is then regarded as 
a pair of edges from the node labeled by the dummy variable to w that carry the boolean 
labels and 1, resp., and that both have amplitude a. 

A special case of QBPs are reversible classical BPs, where each node is reachable from 
at most one node v by a 0-edge and from at most one node w by a 1-edge and v and w 
are labeled by the same variable. It has been proved by Spalek [33J that each sequence 
of (possibly non-reversible) classical BPs with at least linear size can be simulated by 
a sequence of reversible ones with at most polynomial larger size. Since randomized 
(general) BPs can be derandomized while maintaining polynomial size analogously to 
probabilistic circuits (see [2H] for details), the same is true in the randomized case. 

We consider the following variants of quantum BPs defined analogously to their classical 
counterparts. 

Definition 2. 

• A quantum BP is called leveled if the set of its nodes can be partitioned into disjoint 
sets Vx, . . . ,Vi such that for 1 < % < £ — 1, each edge leaving a node in Vi reaches a 
node in V%+\. 

• A quantum read-once BP is a QBP where each variable may appear at most once on 
each path. 

• A quantum OBDD (quantum ordered binary decision diagram) is a quantum read-once 
BP with an order tt of the variables such that for each path in the graph the order in 
which the variables appear is consistent with tt. 
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3. The Separation Result for Mixed Weighted Sum (Theorem [T]) 



For the whole section, let p = p(n) be the smallest prime larger than n for a fixed positive 
integer n. We first deal with the easier upper bound. Our goal is to show that MWS„ 
can be computed by polynomially small error-free quantum read-once BPs. 

Proof of Theorem^ - Upper Bound. The essence of the proof is to apply the Deutsch- 
Jozsa algorithm, evaluating the sums s n (x) and s n (y) in parallel and computing the 
output Xi © Hi if i = s n (x) = s n (y). We first describe the algorithm by a quantum 
circuit. We use a four-part quantum register consisting of two qubits for the Deutsch- 
Jozsa algorithm and two further parts whose basis states are indexed by {0, . . . ,p — 1}. 
The oracle gate for the Deutsch- Jozsa algorithm unitarily extends the mapping S specified 
for a, b G {0,1} by |a)|6)|0)|0) i— > \a)\b © (1 — a)yj © axj}\i)\j), where i = s n (x) and 
j = s n (y). This gate is applied to the initial state (1/2) (|0> + |1))(|0) - |1))|0)|0), giving 
the final state (l/2)((-l)«|0> + (-1)^|1})(|0) - If a measurement of the last 

two parts of the quantum register yields that i ^ j, the output of the circuit is with 
probability 1. Otherwise, i — j and measuring the first two qubits in the Hadamard basis 
yields the output Xi@yi = MWS„(i, y) for the first qubit with probability 1. 

Next we describe the implementation of the obtained quantum circuit as a quantum 
read-once BP. For an easier exposition, we first use unlabeled nodes. We start with 
the construction of a subgraph Gs realizing the mapping S. The nodes of Gs are laid 
out on a grid with 2n + 1 rows and 4p 2 columns, the latter labeled by (a,b,i,j) with 
a, b G {0, 1} and i,j G {0, . . . , p — 1}. Each row represents an intermediate state of the 
four-part quantum register used for the above algorithm. The graph Gs consists of two 
disjoint classical reversible OBDDs Gq and G\ on the subsets of nodes in the columns 
with a = and a — 1, resp. We first describe how Go works. The computation starts 
at a node in row 1 and column (0, b, 0, 0) with b G {0, 1}. The variable vector x is read 
(the order of the variables within the vector does not matter) and the node in row n + 1 
and column (0, b, s n (x), 0) is reached. Then the variable vector y is read (again, the 
order of the individual variables is arbitrary) and the sink in row 2n + 1 and column 
(0, b®y Sn (x), s n (x), s n (y)) is reached. It is easy to see how the described computation can 
be implemented by a reversible OBDD with nodes on the prescribed grid. The OBDD G\ 
works in the same way, but with exchanged roles of x and y and exchanged roles of the 
last two column indices. Altogether, we obtain a classical reversible read-once BP for Gs 
with at most (2n + 1) ■ Ap 2 nodes, which is of order 0(n 3 ) due to the prime number 
theorem. 

We add a new, unlabeled source that for (a, b) G {0, l} 2 is connected to the node in row 1 
and column (a, b, 0,0) of Gs by an edge with amplitude (— l) b (l/2). The sinks of Gs in 
row 2n + 1 and in columns (a, b, with i ^ j are replaced with 0-sinks. All other sinks 
of Gs are replaced with unlabeled nodes connected to a new level of sinks with boolean 
output labels. The outgoing edges of these unlabeled nodes are labeled by amplitudes 
such that, together with the sinks, a measurement in the Hadamard basis is realized. The 
whole graph still has size O (n 3 ) . 

Finally, we remove the unlabeled nodes. For this, we first ensure that all nodes on the 
first level of Gs are labeled by the same variable and the same for all nodes on the last 
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level of Gs with variable labels. We rearrange (e.g.) the variable order of the OBDD G\ 
and update the OBDD accordingly. W. 1. o. g., let x\ be the first variable read in Go 
and let y n be the last. We move the variable x\ to the front of the variable order of G\ 
and y n to the end. It is not hard to see that we can modify G\ in such a way that it 
complies to the new variable order while increasing its size by at most a constant factor 
and maintaining reversibility. After this transformation, we merge the unlabeled nodes 
with their successors (in the case of the source) or with their predecessors (in the case of 
the nodes on the level directly above the sinks). It is obvious how the edges should be 
relabeled such that the resulting graph still computes the same final state as a quantum 
read-once BP. We observe that after the reordering process also the unidirectionality 
requirement for quantum BPs is satisfied. Altogether, we have obtained the desired 
quantum read-once BP for MWS„ of size 0(n 3 ). □ 

Next we prove the lower bound on the size of randomized read-once BPs for MWS n with 
bounded error. We reuse main ideas from the proof an analogous lower bound for WS n 
in [3U]- However, the result for MWS„ is no obvious consequence of that for WS n . We 
have to carefully argue why, different from the quantum case, having two input vectors 
present that play the same roles does not help in the randomized case. 

The proof employs a variant of the rectangle bound method from communication com- 
plexity theory (see, e. g., the textbook of Kushilevitz and Nisan [2l]) suitable for read-once 
BPs, which we fist describe. For this, we introduce some notation. We consider boolean 
functions defined on the union of the disjoint sets of variables X = {x\, . . . ,x n } and 
Y = {yi, . . . ,y n }. For a set of variables Z C X U Y, let 2 Z denote the set of all as- 
signments to Z, i. e., mappings from Z to {0, 1} that we usually identify with vectors in 
{0, 1}' Z L A (combinatorial) rectangle with respect to a partition II = (ITi,!^) of X U Y 
is a set of assignments R = A x B with A C 2 Hl and B C 2 n2 . For t G {1, . . . , n — 1} 
call R an i-rectangle if 111 contains exactly i variables from X and at most £ — 1 variables 
from Y or the same with exchanged roles of X and Y. Call R a one-way rectangle if 
B = 2 U ' 2 . Given a function g on X U Y, R is said to be g-uniform if for all a, a' e A and 
be B, g(a,b) = g(a',b). 

For the following, let a function / on X U Y and a distribution D on the inputs of / 
be given. Let < e < 1/2. We describe how to prove lower bounds for deterministic 
read-once BPs whose output is allowed to differ from / on at most an e-fraction of the 
inputs with respect to V. By a well-known averaging argument due to Yao |SZ|, this also 
gives lower bounds of the same size for randomized read-once BPs computing / with the 
same error probability. 

The essence of the proof technique is to show that, on the one hand, any small determin- 
istic read-once BP that correctly computes / on a large fraction of the inputs with respect 
to T> would give a rectangle with large D-measure on which / is well approximated, while 
on the other hand, using the specific properties of /, the D-measure of any such rectangle 
necessarily has to be small. We now make this more precise. Let R = A x B be a rectangle 
and let < e < 1/2. A function g on XUY is said to uniformly approximate f on R with 
error e with respect to T>, if for all a E A, g differs from / for at most an ^-fraction of the 
inputs in {a} x B with respect to T>. The following main lemma of the proof technique is 
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a variant of a similar statement from [30J, where the uniform distribution and functions 
on a single set of variables have been considered. 

Lemma 1. Let X = {x\, . . . ,x n } and Y = {yx, . . . ,y n }. Let f be a boolean function 
on X U Y and let T> be a distribution on the inputs of f . Let i G {1, . . . , n — 1} and 
< e < e' < 1/2. Then for every deterministic read-once BP G computing a function g 
that differs from f on at most an e-fraction of the inputs with respect to T> there is a 
one-way i-rectangle R that is g-uniform, on which g uniformly approximates f with error 
at most e' with respect to V, and which satisfies T>(R) > (1 — e / e') / (2n\G\) . 

Proof. By an easy adaptation of the well-known proof technique of Borodin, Razborov, 
and Smolensky [TT] (see also |HB], Section 7.6), we get a partition of the input space into 
at most k < 2n\G\ one-way ^-rectangles Ri = A\ x B\, . . . , R^ = A k x B k that are all 
g-uniform. We claim that there is an % G {1, . . . , k} and a subset A\ C A^ such that for 
R = A\ x Bi, T>(R) > (1 — e/e')/k and g uniformly approximates / on R with error e' 
with respect to T>. This obviously suffices to prove the claim. 

Let A* = A 1 U ■ • • U A k . For each x G A*, let (Yl 1 (x),Yl 2 {x)) be the partition of the 
input variables used by the rectangle to which x belongs, and let S x = {x} x 2 n2 ^ x \ Let 
A = {x G A* | T>(S X ) > 0}. For each x G A let e(x) be the P-fraction of inputs from S x 
for which g differs from /. Due to the definitions, the sets S x , x G A, are disjoint and their 
union has D-measure 1. Hence, by the law of total probability, J2 xeA e{x) T>(S X ) < e. 
Let A' = {x G A | e(x) < e'} and let S be the union of all S x for x G A'. By Markov's 
inequality, T>(S) > 1 — e/e'. By averaging, there is a set A" C A' such that for the 
union S' of all S x with x G A", we have T>(S') > T>(S)/k and all inputs from A" belong 
to the same rectangle. Let (rii,!^) be the partition of input variables of this rectangle. 
It is now obvious that the set R = A" x 2 n2 with A" C 2 Hl and V{R) > (1 - e/e') jk is a 
one-way ^-rectangle with the desired properties. □ 

Next we cite two technical lemmas also used in jSU] that build the common core of the 
lower bounds both for the mixed weighted sum function MWS n and the usual weighted 
sum function WS n . The first lemma allows us to argue that partial weighted sums of 
enough random bits are essentially uniformly distributed over the whole range of possible 
values. 

Lemma 2 ([30]). Let q = q(n) be a sequence of primes and let n < q — 1 and n = 

fi(g 2 / 3+5 ) for any constant 5 > 0. Let b G Z* = Z g — {0} where the numbers 

ai, . . . , a n are pairwise different. Then for (x±, . . . , x n ) G {0, l} n chosen uniformly at 

random, |Pr{aiXi + • • • + a n x n = b mod q} — l/q\ = 2~ n ( q ) . 

In the second lemma, we consider the index function IND n : {0, l} n x {1, . . . ,n} from 
communication complexity theory defined for u G {0, l} n and v G {!,..., n} by 
IND„(u, v) = u v . We state an upper bound on the size of one-way rectangles on 
which IND n is well approximated that is implicit in a couple of papers, the earliest 
one being probably that of Kremer, Nisan, and Ron 23 j. For the sake of completeness, 
we include the easy proof. Here and in the following, U denotes the uniform distribution 
on the domain implied by its respective argument. 
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Lemma 3 ([23]). Let e be a constant with < e < 1/2. Let R = Ax {l,...,n} 

with A C {0, 1}™ be a one-way rectangle for which a function g exists such that R is g- 
uniform and g uniformly approximates IND n on R with error e with respect to U . Then 
U{R) = 2- n(n \ 

Proof. Since R is g-uniform, there is a vector r G {0, 1}™ such that, for each a £ A, 
(g(a, 1), . . . , g(a, n)) = r. Since g uniformly approximates IND n on R with error at 
most e with respect to the uniform distribution, r has Hamming distance at most \en\ 
to each vector in A. It follows that \A\ is upper bounded by the size of Hamming balls 
of radius \en\, which is known to be at most 2 H ( £ ' n , where H(x) = — (xlogx + (1 — 
x) log(l — x)) for x G [0, 1] is the binary entropy function. Thus, U(R) = \R\/ (n ■ 2 n J = 
|A|/2™ < 2~( 1 ~ H( - £ ^ n = 2~ n ( n \ □ 

Now we describe the details that are particular to the function MWS„. For the rest 
of the section, let X = {xi, . . . , x n } and Y = {yi, . . . , y n } be the sets of variables on 
which MWS n is defined. Recall that p = p(n) is the smallest prime larger than n. We 
concentrate on the set of difficult inputs D = {(x,y) \ s n (x) = s n (y)} by working with 
the distribution V with V(x,y) = l/\D\ if (x, y) G D and V(x,y) = otherwise. 

As a preparation of the proof of the lower bound for randomized read-once BPs com- 
puting MWS n , we derive some basic facts about the considered one-way rectangles. We 
use the following notation. For a set S C X (or S C Y) of variables and a partial as- 
signment a that fixes at least all variables in S, let cr s (a) = (X^es^) ' a ( v )) m °dp, 
where i(v ) G {1, . . . , n} denotes the index of the variable v in X (or Y, resp.), and a(v) 
is the value that it obtains by the assignment a. 

Lemma 4. Let £ = n— 6(jo 2 / 3+<5 ) for some constant 5 with < 5 < 1/3. Let li = (Hi, U 2 ) 
be a partition of X U Y with |IIi n X\ = £ and |IIi D Y\ < £ - 1. Let R = A x 2 n2 with 
A C 2 Ul and suppose there are i x , i y G {0, . . . ,p— 1} such that for all a G A, cr nin x(a) = i x 
and crn 1 ny(ci) = For eac/i k G {0, . . . ,p — 1} define Bk as the set of all assignments 
b G 2 n2 with o-u 2 nx(b) = (k — i x ) modp and o~u 2 r\Y(b) = (k — i y ) mod p. Then we have 
the following. 

(i) For each k G {0, . . . ,p— 1} and (a, b) G AxBk, o~x(a, b) = ay (a, 6) = fc. Furthermore, 
U{B k ) = (1/p 2 ) ■ (1 ± o(l)) and V{A x B k ) = (l/p) ■ U{R) ■ (1 ± o(l)). 

(ii) V(R) = U(R) ■ (1 ±o(l)). 

Proof. Part (i): The first part of the statement is obvious. It remains to prove the claims 
about U(B k ) and D(A x B k ). Let b denote an assignment from B k chosen uniformly at 
random. Then, using that disjoint parts of b are independent of each other and applying 
Lemma El we get 

U(B k ) = Pr{o-n 2 nx(&) = k - i x A On 2 ny(&) = k - i y } 

= Pi{a U2n x{b) = k-i x }-Pr{au 2 nY{b) = k-i y } = — -(l±o(l)). 
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Furthermore, also by LemmaEl U(D) = (1/p) • (1 ± o(l)). Again by the independence of 
disjoint parts of uniformly random assignments and by observing that A x Bk C D and 
U{A) = U(R), we obtain 



U((AxB k )nD) 
U(D) 



U(A) ■ CTXgfc) 
U(D) 



P 



1 



• r/(i2).(i± (i)). 



Pari (ii): This follows from the first part, since R n -D is the disjoint union of the sets 



Finally, we are ready to prove the desired lower bound on the size of randomized read-once 
BPs for MWS„, 

Proof of Theorem^ - Lower bound for randomized read-once BPs. Following the outline 
above, we prove the lower bound for deterministic read-once BPs that correctly com- 
pute MWS„ on a large fraction of the inputs. Let < Eg < 1/2 be any constant and 
let G be a deterministic read-once BP computing a function g that differs from MWS„ 
on at most an e^-fraction of the inputs with respect to T>. Choose £ = n — (p 2 / 3+l5 ) for 
a some constant 5 with < 5 < 1/3. Let e be a constant with Eq < e < 1/2. Let R be 
a one-way ^-rectangle that is (/-uniform and on which MWS„ is uniformly approximated 
by g with error at most e. We prove that T>(R) = 2~ n( - n \ By Lemma d this yields the 
desired lower bound \G\ — 2 n( - n \ 

Let LT = (IIijILj) be the partition of the input variables used by R, where w. 1. o.g. 

n X\ = £ and |IIi n Y\ < £ - 1. Let R = A R x 2 n2 with A R C 2 n \ Using averaging, 
we fix an assignment a G 2 UlC[Y and an i x e {0, . . . ,p — 1} such that for the set A of 
all assignments a' G Ar that are consistent with a and satisfy cr ni nx( a/ ) — ixi we have 
V(Ax2 n2 ) > V(R)/(p-2^ nY \). Let i y = a ninY (a). Let R' = {x G A x 2 n2 | V{x) > 0}. 
Since ^ approximates MWS„ uniformly on R with error at most e with respect to T>, we 
know that g differs from MWS„ for at most an e-fraction of the inputs in R' with respect 



Let III H X — {xj t , . . . ,Xj e }. We observe that, due to the prime number theorem, p < 
n + o(n) and thus £ > n — o(n) and £/p > 1 — o(l). Let S , • • • , -B p _i C 2 n2 be the sets 
of assignments according to Lemma 0] for R' and i x ,i y . Let B = Bj x U ■ • • U Bj r Then we 
have the following. 

Claim 1. The function g differs from MWS n on at most a fraction of e ■ (1 + o(l)) o/ t/ie 
inputs in Ax B with respect to the uniform distribution. 

Proof of ClaimUl Due to part (i) of Lemma H V(A x B) > (£/p) ■ U(R') ■ (1 - o(l)) > 
U(R')- {l-o(l)). On the other hand, by part (ii) of LemmaH V(R') < U{R') ■ (l + o(l)). 
Thus, the inputs in A x 5 cover at least a (1 — o(l))-fraction of the rectangle R 1 with 
respect to T>. It follows that g differs from MWS„, on at most a fraction of e ■ (1 + o(l)) 
of the inputs in A x B with respect to T>. Since A x B C. D, the same is true for the 
uniform distribution. □ 

Next we further reduce the obtained set A x B by picking appropriate representatives of 
each of the subsets Bj t , . . . , Bj t of B. 



A x Bk over all k — 0, . . . ,p — 1. 



□ 



to V. 
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Claim 2. There are b\ G Bj 1} . . . , bg, G Bj e such that g differs from MWS„ on at most a 
fraction of £ ■ (1 + o(l)) of the inputs in R" = A x {bi, . . . , be} with respect to the uniform 
distribution. 

Proof of Claim® We choose a collection of disjoint subsets {bi,...,be} of B with 
&i G -B^, G -B^ whose union _£>' is as large as possible. Since U(Bk) > (1/p 2 ) • 

(1 — o(l)) for each = 0, ...,p — 1 by part (i) of Lemma HI we can ensure that 
U(B') > (£/p 2 ) ■ (1 - o(l)) > (1/p) • (1 - o(l)). On the other hand, also by Lemma H 
U(B) < (l/p) ■ (1 + o(l)). Hence, the set Ax B' covers at least a (1 — o(l))-fraction of 
the inputs in A x B. It follows that the relative error of g on A x B' with respect to the 
uniform distribution is bounded by some e' with e' < £ ■ (1 + o(l)). By averaging, there is 
thus at least one subset . . . , 6^} in B' such that A x {6 1; . . . , be} has relative error e' 
with respect to the uniform distribution. □ 

Let R" = A x . . . ,be} be a rectangle according to the above claim. Now we ap- 
ply the result for the index function from Lemma EJ For simplicity, we assume that 
ji = 1, . . . , je = £ such that the set of all restrictions of the assignments in A to the vari- 
ables in ili fl X can be identified in the obvious way with a subset A IND C {0, 1}^ of the 
same size. Recall that for each assignment in A, the variables in LTi fl Y are fixed accord- 
ing to the assignment a chosen above. We regard -Rind = And x {1, ...,£} as a one-way 
rectangle for the index function IND^. Define the function h on inputs u G {0, l} e and 
ve{l,...,£}by 

h(u, v) = 



g((u,a),b v ) © a(y v ), if y v G IIi; and 
g((u,a),b v ) ®b v (y v ), if y v G il 2 ; 



where we regard u as an assignment to LTi fl X in the argument of g. Since b v G B v and 
for each a 1 G A, ax(a', b v ) = cry (a', b v ) = v, 



MWS n {(u,a),b v ) 



u(x v ) © a(y v ), if y v G EEi; and 
u(x v ) © b v (y v ), if y v G n 2 ; 



and h(u, v ) = u v = IND^(it, v) if g((u, a), b v ) = MWS„((m, a), b v ). 

The rectangle -Rind is /i-uniform since R" is ^-uniform and the values a(y v ) and b v (y v ), 
resp., added to the output of g depend only on the second part v of the input. Since g 
differs from MWS n on at most a fraction of e' = e • (1 + o(l)) of the inputs of -R" with 
respect to the uniform distribution, h differs from IND^ on at most an e'-fraction of -Rind 
with respect to the uniform distribution. By LemmaEl it follows that U(Rwd) = 2~ n( -^ . 
Furthermore, 

U(R') = |A|/2 |ni1 = 2~ |riiny| ■ |Ai ND |/2 £ = 2- |riiny| ■ U(Rmd) 

and, by part (ii) of LemmaH V(R') < U(R')-(l+o(l)). Finally, V(R) < p-2^ inY ^V(R'). 
Putting everything together, we have shown that T>(R) = p ■ 2~ n<yt> . Since p < n + o(n) 
and £ > n — o(n), this bound is of the desired size. □ 

The lower bound for quantum OBDDs stated in Theorem Q follows by standard commu- 
nication complexity arguments and the properties of MWS n already used above. 
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Proof of Theorem^- Lower bound for quantum OBDDs. Let G be a quantum OBDD 
computing MWS„ with error bounded by a constant e, < e < 1/2. Let I = n— Q (jr> 2 / 3+<5 ) 
for some constant S with < 5 < 1/3. Appropriately cutting the list of variables used 
as the variable order for G in two parts gives a partition II = (n 1 ,II 2 ) of the set of 
variables X UY that, w. 1. o. g., satisfies III! Pi X\ — £ and III! D Y\ < £ — 1. Choose 
a G 2 niny somehow arbitrarily and let i y = ern in y(a)- Furthermore, again w. 1. o. g., 
suppose that IT fl X = {1, . . . ,£}. For any i x G {0, ... ,p — 1}, Lemma El yields the 
existence of assignments h Xi i, . . . , b^j G 2 n2 such that cji 2 nx(bi xt j) = (j — i x ) mod p and 
°Ti 2 ny(&w) = U - h) mod V for j = 1, . . . , I. 

The given quantum OBDD G can now be used by the two players Alice and Bob in 
a quantum one-way communication protocol for IND^ as follows. Let u G {0, 1}^ and 
v G {1, . . . , £} be the inputs for IND^. Alice follows the computation in G for the partial 
input (u, a), regarding u as an assignment to the variables in II! fl X, and sends the 
reached superposition as well as the partial weighted sum a^nxiu) to Bob. Bob finishes 
the computation of G using the partial input bi X)V and outputs the XOR of output bit of G 
with a(y v ), if y v G IIi fl Y, or with b ix!V (y v ), otherwise. It is easy to see that, analogously 
to the end of the proof of the lower bound for randomized read-once BPs, this gives a 
protocol for IND^ that has the same error probability as G. As proved by Klauck [15], the 
complexity of quantum one-way communication protocols for IND^ with bounded error is 
lower bounded by Q(£), which together with the facts that only O(logp) = O(logn) bits 
are required to communicate i x and that £ > n — o(n) implies \G\ = 2 n( - n \ as claimed. □ 

4. The Lower Bound for Set-Disjointness (Theorem [2]) 

In this section, we prove that quantum BPs reading each variable exactly once and 
computing DISJ n with two-sided error bounded by a small positive constant require 
size 2 n( - n \ We first present definitions and tools from information theory in the next 
subsection. We then introduce quantum multi-partition protocols (Subsection 14.2(1 and 
prove a lower bound on the information cost of such protocols for the AND of just two 
bits ( Subsection 14.3(1 . This is used as a building block for the proof of the desired main 
result in the last subsection. 

4.1. Information Theory 

We assume that the reader is familiar with classical and von Neumann entropy and refer 
to [23 for an introduction. We briefly review some important definitions. 

Let X be a classical random variable taking values in a finite set R and for each x G 
R let p(x) be a quantum state over a fixed Hilbert space. Then the state p(X) = 
^ xei? Pr{X = x} ■ p(x) is called quantum encoding of X by (p(x)) xe R. For the special 
case where p(x) = \x)(x\ for each x G R and (\x)) xe R is an ON-basis, we just write X 
instead of p(X). For an additional random variable Y and a value y in the range of Y, 
let p(X | Y = y) = £, 6R Pr{X = x | Y = y} ■ p(x). 
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For a quantum state p, S(p) denotes the von Neumann entropy of p. For a joint 
system (A,B,C) with subsystems A, B, C, define S(A\B) = S(A,B) - S(B) (con- 
ditional entropy), I(A:B) = S(A) + S(B) — S(A,B) (mutual information between A 
and B), and I(A:B\C) = S(A | C) + S(B | C) - S(A, B | C) (conditional mutual in- 
formation). For classical random variables X, Y, and Z, a value z in the range of Z, 
and quantum encodings p(X),o~(Y) of X and Y, resp., we use the notational shortcut 
I(p(X) : a(Y) \Z = z) = I(p(X | Z = z) : a(Y | Z = z)). We list the following standard 
facts for easier reference (see, e.g., [21], Sections 11.3-11.4). 

Fact 1. 

(i) Let p AB be a pure state of the joint system (A, B) andletp A ,p B be the corresponding 
reduced states of the subsystems A and B, resp. Then S(p A ) = ^(p 8 ). 

(ii) Let p(X) = YIxgr P r {^ = x } ' p( x ) be a quantum encoding of a classical random 
variable X taking values in the finite set R. Suppose that the states p(x), x G R, 
have support on orthogonal subspaces. Then S(p(X)) = H(X) + J2 x eR^ T {X = 
x} ■ S(p(x)), where H(X) is the classical entropy of X. 

(Hi) Let p(X) be a quantum encoding of a classical random variable X taking values in a 
finite set R. Then S(p(X)) > J2 x eR P r {-^ = x } ' S(p(x)) (concavity of the entropy). 

(iv) Let X,Y be classical random variables with finite range, let R be the range of Y , 
and let p(X) be a quantum encoding of X . Consider a bipartite system with 
state (p(X),Y) = J2 yeB Pr{Y = y} ■ p(X \Y = y) ® \y)(y\. Then S(p(X)\Y) = 
S(p(X), Y) - S(Y) = EyenMY = v} ■ S(p(X \ Y = y)). 

(v) Let X,Y be classical random variables with finite range, let R be the range of Y , 
and let p(X),o~(X) be quantum encodings of X. Consider a tripartite system with 
state (p(X),a(X),Y) = E^PrfY = y} ■ p(X | Y = y) ® a(X \ Y = y) ® \y)(y\. 
Then I(p(X) : a(X) \ Y) = J2 yeR Pr{Y = y} ■ I(p(X \Y = y) : a(X \Y = y)) . 

(vi) I(A : B) < I(A : BC) (monotonicity of mutual information). 

(vii) Let X = (X%, . . . , X n ), where Xi, . . . ,X n are independent classical random vari- 
ables. Then for any quantum encoding p(X) of X, I(p(X) : X 1; . . . , X n ) > 
Y^l=i I{p{X) '■ Xi) (superadditivity of mutual information) . 

We observe the following additional property that follows from the definitions and the 
fact that the von Neumann entropy of pure states is zero. 

Fact 2. Let p(X) be a quantum encoding of a classical random variable X and suppose 
that for each value x that X can attain, p(x) is a pure state. Then I(p(X) : X) = S(p(X)). 

Furthermore, we work with standard measures for the distance of quantum states. Let 
p, a be quantum states over the same Hilbert space. The trace norm of p is defined as 
||p||t = tr |p| = tr a/ ptp and the trace distance of p and a as ||p — a|| t . The fidelity of 
p and a is defined as F(p,a) = tr */ ^fpa^fp. Note that for pure states and j^), 
F(\ipi)(ipi\, IV^XV^I) = | ^2) |- We will also use the following facts (see, e.g., fTf\ . 
Section 9.2). 
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Fact 3. 

(%) Let \ip2) denote pure quantum states. Then || \ipi) (ipi\ — IV^KV^IH! = 

4(1-F(|^)(^|,|^ 2 )^ 2 |) 2 ). 

(ii) Let po, pi be quantum states and suppose that there is a POV measurement with 
boolean results that yields the result b £ {0, 1} on state p^ with probability at least 1—e. 
Then F(po, Pl ) < 2y/e(l-e). 

Further, we note the following "weak inverse triangle inequality" for the inner product of 
real unit vectors. 

Proposition 1. Let \u),\v),\w) be real unit vectors. Then (u\w) > 
2((u\v) + (v\w)) -3. 

Proof. This follows from 

|||w) — |«j)||2 < (j\\u) - \v)\\ 2 + \\\v) - \w)\\^j < 2^\\\u) - \v)\\ 2 2 + \\\v) - \w)\\fj 
on the one hand and 

|||u)-|u;)||2 = 2(1 - (u\w)) 

II 1 1 2 1 1 1 1 2 

and similarly for — |f)|| 2 , \\\v) — \w)\\ 2 on t ne other. □ 

Finally, we need one of the main technical tools from ^HIEI] used also in fHJE] ■ The 
strong version cited below has independently been derived in [TTflll4| . 

Lemma 5 (Local transition lemma [19,14j). Let X describe a classical uniformly 
random bit. Let po,pi be quantum states over some finite dimensional Hilbert space H. 
Let p(X) = (p + Pi)/2. Let \ipo); IV'i) ^ e purifications of p and pi, resp., in Ti ® K,, 
where JC is a Hilbert space of dimension at least the dimension of 71. Then there is a 
unitary transformation U on K such that for \tp' Q ) — (I ® U)\ipo), where I is the identity 

on n, \\\4>i)m - w )m\\ t < v 2/ (pw : x). 

4.2. Quantum Multi-Partition Communication Protocols 

We consider the following simple quantum variant of communication protocols that may 
have more than one input partition. We use quantum one-way communication protocols 
with a single input partition as defined, e.g., in [22], as building blocks. 

Definition 3. A quantum k-partition (one-way) communication protocol P with respect 
to nontrivial partitions LEi, . . . ,11^ of the set of input variables consists of a collection 
of one-way quantum protocols Pi, . . . , Pk with respect to LTi, . . . , Hfc, resp., and numbers 
«i, . . . , ojfc G C such that | cti | 2 + • • • + | ct:^ | 2 = 1- Call ax, . . . , initial amplitudes of 
their respective subprotocols. For % = 1, . . . , k let Tti = Tii^A ® 7~Li,c ® 7~Li,B be the state 
space of Pi. We require that Hi and Hj are orthogonal for % ^ j. Let H = Hi © • • • © Hk 
be the global state space of the whole protocol. 
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The Hilbert space Hi describes the state of a register of qubits on which the subprotocol Pi 
works. For an input z = (x,y) partitioned into x,y according to Hi, the initial state of 
the register is \si(z)) = |x)-^ 4A |00. . . 0)^ C \y)-Hi B , where the three parts of the register 
belong to the subspaces as indicated. The qubits belonging to H^a and H^b, resp., are 
called the input registers of the players Alice and Bob, resp., and those belonging to 
H.i,c work register. The computation of Pi is carried out as usual for quantum one-way 
protocols. Let Ui be the unitary transformation on Hi realized by protocol Pi. 

The global initial state of P is Yli=i a i\ s i( z )) an d the global final state is Yli=i a iUi\si(z)). 
Define P\ (z), ... , Pk{z) and P(z), the result states of the respective protocols, as the states 
obtained from the respective final states by a partial trace over the qubits in the input 
registers of the players. The output random variable of Pi with values in {0, 1} is defined 
as the result obtained by a POV measurement of a designated output qubit in Pi{z) 
owned by Bob. Let M iy0 , M it i be the linear operators with M/ Mj + Mj 1 Mi ) i = I (the 
identity on TCi) that describe this measurement. Then the output random variable of P 
is the result of the POV measurement described by the operators Yli=i Me,o> Si=i 
This allows to define the computation of boolean functions with different kinds of error 
as usual. A quantum multi-partition communication protocol is a quantum fc-partition 
communication protocol for some k. 

Remarks. 

• We do not define the communication complexity of quantum multi-partition protocols 
here (which can be done in a straightforward way), since we measure the complexity 
using an appropriately defined notion of information cost (see the next subsection). 

• Opposed to more generous models of quantum one-way protocols, the subprotocols of 
our quantum multi-partition protocols are defined such that the players do not obtain 
any additional, entangled qubits (EPR pairs) as part of the initial state of the protocol. 

• The above definition can easily be generalized by allowing general quantum operations 
for initialization, more than one round, or entanglement between the players. We do 
not need this kind of generality for our later application, though. 

• Due to the orthogonality of the subspaces of the subprotocols, for each input z, P(z) = 
Pi (z) + • • ■ + Pk{z). For the same reason, the measurement operators for the output 
random variable of P defined above indeed give a POV measurement. Finally, let 
0i, . . . , Oh and O denote the output random variables of Pi, . . . ,Pk and P, resp. Then, 
for r e {0, 1}, Pi{0 = r} = £j = i Wi? Pr{0* = r}. 

• The initial amplitudes of a quantum multi-partition protocol may be assumed to be real 
and positive by pushing phase factors into the initial states of the subprotocols. 

Our goal is to measure the mutual information between the result state of a protocol and 
a random input by the simple formula in Fact El Hence, it is important that the result 
state of the considered protocol is pure for a given input. At the first glance, this no 
longer seems to work if we want to run the protocols on random inputs and want to allow 
them to use random coins. The problem is overcome by using input conventions and a 
simple extension of the model as described in First, we consider only protocols 

that are safe in the following sense. 
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Definition 4 (Safe protocols). A communication protocol is called safe if both players 
may access their input registers only once at the beginning to make copies of their inputs 
into the work register. They are not allowed to access the input registers for working, 
communicating, or measuring afterwards. 

It is obvious that requiring protocols to be save does not change their computational power 
if we restrict ourselves to classical inputs as usual. The convention prevents protocols 
from entangling their work qubits with the input registers during the computation, which 
could lead to the production of extra entropy besides that contained in the inputs by the 
trace-out operation at the end of the computation. 

Furthermore, we want to run protocols on random inputs and allow the protocols to use 
public random coins, but only want to work with unitary transformations, even for the 
preparation of the initial state. By modifying the model as follows, this is possible. 

Definition 5 (Protocols with random inputs and public random coins). There 
is an additional (public) random coin register whose number of qubits may depend on 
the length of the input of Alice and Bob. Furthermore, the input registers of Alice and 
Bob and the random coin register are each augmented by a secret register of the same 
size that are each only initialized once at the beginning and never accessed afterwards. 

The protocol is run for random inputs of the two players described by random variables 
X and Y and random coins described by the random variable Z as follows. At the 
beginning, Alice prepares the states ^ X P?{X = x} 1//2 |x)|x) and ^ z ¥v{Z = z } 1 ^ 2 \ z )\ z ) 
in the two joint registers formed by her input register together with its secret register 
and by the public random coin register and its secret register (where, e.g., the first 
part of each state belongs to the regular register and the second part to the secret one). 
Analogously, Bob prepares the state ^ P?{Y = y} l ^ 2 \y)\y) in his input register and the 
corresponding secret register. The result state of the protocol is obtained by taking the 
final computational state and tracing out the input registers of both players, the random 
coin register, and all secret registers. This is a mixed state which is equal to what we 
would have obtained had we started the protocol on random assignments to the input 
registers and the random coin register as described by X, Y and Z, resp., in the first place. 
The output random variable of such a protocol is the result of a POV measurement of a 
qubit owned by Bob at the end, excluding the bits of the random coin register. 

Although the result state according to the extended definition above also depends on Z, 
we stick to the notation P(X, Y) for this state for convenience. We summarize the 
properties of the modified protocols that are crucial for the following proofs. 

Fact 4. For a fixed (non-random) assignment to the input registers and the random coin 
register, the result state of a quantum multi-partition protocol as described in Definition^ 
is pure. Furthermore, for registers initialized with pure states describing random inputs 
and random coins according to the convention in the definition, the computational state 
at the end of the protocol before tracing out the input registers, the random coin register, 
and the secret registers is also pure. 
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4.3. Information Cost of Quantum Multi-Partition Protocols for AND 

Here we prove that the information cost of a quantum multi-partition protocol computing 
the AND of two bits is lower bounded by a positive constant. For measuring the infor- 
mation cost, we adapt the approach of Bar-Yossef, Jayram, Kumar, and Sivakumar [Z| 
for classical randomized communication protocols and use the information that the result 
state of a protocol provides on the inputs (the result state replacing the classical tran- 
script), rather than the weighted sum of the information in individual messages as in the 
paper of Jain, Radhakrishnan, and Sen jTH|. This makes sense also in the quantum case 
since we do not use entanglement and have only a single round of communication. 

Definition 6. 

• Let P be a quantum fc-partition protocol. Let D be any random variable and let Z be a 
random variable describing an input for P. Then the information cost of P with respect 
to Z and conditioned on D, denoted by IC(P; Z | D), is defined as I(P(Z) : Z \ D), 
where P(Z) is the result state of P. 

• For a function /, any random variable D, and a random variable Z describing an 
input for /, the e-error information cost of quantum k-partition protocols for f on Z 
conditioned on D, lCk, e {f] Z\D), is defined as the infimum of the information cost over 
all quantum fc-partition protocols computing / with error at most e. Furthermore, let 
IC e (/; Z | D) = mhifcgitsj ICfc i£ (/; Z \ D) denote the information cost of quantum multi- 
partition protocols for / with error at most e. 

To explain some of the difficulties that arise if we want to extend the result of Jain, Radha- 
krishnan, and Sen for protocols with a single partition computing AND to multi- 
partition protocols, we consider the situation for the XOR of two bits Zi,z%. We choose 
the following input distribution as defined in (HE]: Let D G {1,2} with Pr{D = 1} = 
Pr{L> = 2} = 1/2. Let Z = (Zi, Z 2 ), where for i = 1,2, Pr{^ = | D = i} = Pr{Z; = 
1 | D = i} = 1/2 and Pr{Z 3 _; = | D = i} = 1. 

Proposition 2. There is an error-free quantum 2-partition protocol for XOR on the 
random input Z conditioned on D where the subprotocols do not communicate at all and 
where each subprotocol has zero information cost with respect to Z and conditioned on D. 

Proof. By an application of the Deutsch-Jozsa algorithm. We define a 2-partition pro- 
tocol P according to the partitions ({^i}, {22}) an d ({^2}, {^i})- The protocol uses two 
qubits as work space and subprotocols Pi, Pi both weighted by the amplitude l/v2 (it 
uses no random coins). The first work qubit is used for computing, the second one only 
to implement a phase oracle as usual. In subprotocol Pi, i — 1,2, the first work qubit is 
initialized with \i — 1). The only player to act in Pj is Bob. The only thing he does is 
multiplying the phase of the first work qubit by (— l) Zi . Then by a measurement of the 
first work qubit in the global result state in the Hadamard basis, the value XOR(zi,Z2) 
can be retrieved with error probability 0. It is easy to check that the mutual information 
between the result state P%{Z) of subprotocol Pi and Z is zero, since Bob only encodes 
his input in the phase of the work qubit. □ 
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On the other hand, by examining the proof of jTHj for the AND of two bits, it can 
be shown that for each quantum 1-partition protocol computing XOR with a bounded 
number of rounds and with bounded two-sided error, the communication complexity as 
well as the information cost in either the definition of or the definition used here is 
lower bounded by a positive constant. In fact, the proof in ^3] only exploits the fact 
that a protocol for AND has to be able to distinguish the inputs 01 and 10 from 11 with 
high probability and thus works in the same way for XOR. The example of XOR and the 
above proposition show that a lower bound on the information cost or communication 
complexity for a single partition does not simply carry over to a lower bound for multiple 
partitions in an obvious way. 

As a preparation of the proof of our result for the AND function, we state the following 
concavity property of the information cost of multi-partition protocols. 

Lemma 6. Let P be a quantum k-partition communication protocol with subproto- 
cols Pi, . . . ,Pk and initial amplitudes a>i, ...,^60, where \ai\ 2 + ■ ■ ■ + \dk\ 2 = 1. Let D 
be any random variable and let Z be a random variable describing a random input for P . 
Then IC(P; Z \ D) > J2i=i \ a i\ 2 IC(Pj; Z\D). 

Proof. We regard the public random coins of P as part of Alice's input for this proof. 
Then by the definition of the protocols, the result state P{z) for a fixed input z (which 
in fact fixes the regular inputs of Alice and Bob, the random coins, and the values for 
the secret registers) is a pure state. Notice, however, that this does not mean that the 
proof only works for pure result states. When running P on the random input Z and 
randomly chosen random coins according to the conventions, the trace-out of the input 
registers and the corresponding secret registers still yields a mixed result state P{Z). 

By definition of the information cost, the statement in the claim is equivalent to 

k 

I{P{Z):Z\D) > Y,Wi\ 2 I{P l {Z):Z\D). 

i=l 

According to Fact 1(0), it suffices to prove this without the condition on D. Using that 
the result states of Pi, . . . , P& and P are pure states for a fixed input and Fact El it further 
suffices to prove that 

k 

s(p(z)) > Y,\^\ 2 m(z)). 

i=l 

For notational convenience, let p z = Pr{Z = z} for any input z. For i = 1, . . . , k let 
\Pi(z)) denote the vector belonging to the pure result state Pi(z) of the subprotocol p. 
Purifying the global result state P{Z) of P, we obtain 

k 

w = /2 ai J2vp~*\ p i( z ))® \z). 

i=l z 

Let p = \ip)(ip\ and let p A and p B be the reduced states obtained from p by a partial 
trace over the second and first part, resp., of the state space. Using Fact [Tlji)) . we get 

S(P(Z)) = S(p A ) = S(p B ). 
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Hence, we investigate p . We have: 

P B = tr A (£a i a* j ^y/fry/fflP i (z))(P j (z?)\®\z)(z'\) 

i,j z,z' 

= EVp^I^'I •tr(X;^*|P^))(P i (/)|) 

z,z' i,j 
z,z' i 

The last row follows from the fact that the state spaces of different subprotocols are 
mutually orthogonal. We write the result as 

k 

P B = ^2\ai\ 2 pi with pi = ^2 ^zVp^ (Pi(z') \Pi(z))\z)(z'\, i = 1, . . . , fc. 

i=l z,z' 

Define 

\A) = J2Vp~z\Pi(z))^\z). 

z 

Then p^ is obtained from \ipi)(ipi\ by tracing over the first part of the state and tracing 
over the second yields Pi(Z). Hence, for each i, S(pi) = S(Pi(Z)), which together with 
the concavity of the entropy (Fact ITlpii|) ) proves the claim. □ 

Next we observe that quantum multi-partition protocols with only two different partitions 
can be simplified to quantum 2-partition protocols. This is obviously applicable to any 
quantum multi-partition protocol for a function on just two variables like AND. 

Proposition 3. Each quantum multi-partition protocol P with respect to partitions from 
the set {n!,n 2 } can be turned into a quantum 2-partition protocol P' with respect to Hi 
and n 2 that has initial amplitudes ^/qi, ^fq^ with qi, q 2 > and q x + q 2 = 1 and that for 
each input has the same result state as P. 

Proof. Let P be a quantum (k\ + /^-partition protocol for / with partitions Hij = Hi 
for j = 1, • • • , k\ and n 2 j = n 2 for j = 1, . . . , /c 2 . For i = 1, 2 let a^i, . . . , be the 
initial amplitudes of these partitions and let g« = J2/=i \ a i,j\ 2 - 

Define a quantum 2-partition protocol P' with initial amplitudes ^Jqi, ^Jq^^ and partitions 
Hi and n 2 as follows. For % — 1,2 and j = l,...,ki let |sjj) be the initial state of 
the subprotocol with partition Ily in P. Then for % — 1,2 the initial state of the 
subprotocol P( of P' with partition is defined as ^2j(o(ij / \/ql)\sij) , if qi ^ 0, or as 
an arbitrary pure state, if qi = 0. In this way, we get a legal pure state that can be 
prepared by Alice at the beginning of the computation of the ith subprotocol. In P/, the 
players then simulate the respective subprotocols P^i, . . . , P^. of P in parallel. By the 
definitions it is obvious that, for each input, the final computation state of P' agrees with 
that of P. Hence, the same follows also for the result states. □ 
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Furthermore, we observe that it suffices to work with real amplitudes in the protocols. 
For a complex vector space with basis bi, . . . ,b n , its realification is the real vector space 
spanned by the basis b\, . . . , b n , ib\, . . . , ib n (using the operations of the complex vector 
space but allowing only real scalars). The realification of a complex vector is obtained by 
replacing each of its entries with two entries containing its real and imaginary part, resp. 
To get the realification of a complex matrix, replace each of its entries a with a 2 x 2- 
block (llll) where b% = 64 = Re(a), 63 = —62 = Im(a). The realification of a quantum 

state p = YA =1 Pi\^i)(^i\, with p x , . . . ,p n > 0, p x + h p n = 1, and • • • , |V>n) an 

ON-basis, is the quantum state p' = Y^i=iPiWi) Wi\ where \ip[) is the realification of 
for i G {1, . . . ,n}. Finally, the realification of a quantum communication protocol is 
the protocol resulting from the replacement of the initial state as well as of the matrices 
describing the computation and the measurements of the protocol with their realifications. 
It is easy to see (see also Lemma 6) that the final state of the resulting protocol is 
then the realification of the original final state. For our purposes, we require the following 
additional fact. 

Fact 5. The von Neumann entropy of a quantum state agrees with that of its realification. 
In particular, the information theoretical measures introduced at the beginning of the 
section are preserved if all involved states are replaced with their realifications. 

Proof. Let p and p' be a quantum state and its realification, resp., as defined above. Then 
the realifications of the vectors • • • , \if) n ) and i|V>i), • • • , i\i>n) constitute an ON-basis 
of eigenvectors of p' with corresponding eigenvalues p±, . . . ,p n and the eigenvalue with 
multiplicity n. Hence, S(p') = S(p). The second part of the claim is obvious. □ 

Now we consider the AND of two bits Z\ , z% . We consider the same input distribution 
for AND as described before for XOR. Recall that D E {1,2} with Pr{D = 1} = 
Pr{D = 2} = 1/2 and that Z = (Z U Z 2 ), where for i = 1,2, Pr{Z; = | D = i) = 
Pr{Zj — 1\ D — i} — 1/2 and Pr{Z 3 _j = | D — i} — 1. We are now ready to state and 
prove the main theorem of this subsection. 

Theorem 3. Let e > and 5 = 2ye(I — e) be such that 5 < 1/7 (or, equivalently, 
e < 1/2 - 2V3/7 w 0.005). Then IC e (AND; Z\D)> 1/28 - 5 /A. 

The plan for the proof of the theorem is as follows. We have to show that if a given 
protocol P computes AND with small error probability, then I(P(Z) : Z | D) is large. 
First, we can restrict ourselves to 2-partition protocols using Proposition El We then 
apply Lemma |H1 to lower bound the overall information I(P(Z) : Z \D) by the average of 
that given by the subprotocols P±, P2 of P. Due to the known results, it is clear that 
the information provided by an individual, single-partition subprotocol about a random 
input of the considered kind is large if it computes AND with small error probability. But 
this does not suffice to conclude the proof, as the example of XOR discussed above shows. 
The problem is that, in general, having a protocol P with small overall error probability 
for each input does not imply that there is a subprotocol which shares this property. As a 
way around this problem, we use the fidelity as a measure for the ability of the protocols 
to distinguish between the inputs 00, 01, and 10 on the one hand and the input 11 on 
the other. Using the properties of the fidelity, we can show that if the whole protocol can 
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reliably distinguish between these sets of inputs, which it has to if its error probability 
is to be small, then the same is true for at least one of the subprotocols. The local 
transitition lemma then in turn implies that this subprotocol provides a nonnegligible 
amount of information about a random input as chosen above. We now make this more 
precise. 

Proof of Theorem^ Due to Proposition EJ we may assume that the given protocol 
for AND is a 2-partition protocol with respect to the partitions 111 = ({^i}, {^2}) and 
n 2 = ({-22}, {^i})- Let P be such a protocol computing AND with error at most e. Let 
Pi,P 2 be the subprotocols of P that have initial amplitudes ot\ = y/q~i,a 2 = ^fq^ with 
<Zi> <Z2 > and q% + q 2 — 1. Furthermore, because of FactEl we may additionally assume 
that P uses only real numbers in its transition and measurement matrices as well as in 
its computational states. 

Let Z = (Zi, Z 2 ) be the input random variable for P as defined before and let Zij = Zj 
and Z 2 j = Zs_j for j = 1, 2. We denote the result state of P on Z by P(Z). By LemmaEl 
and Fact [TTJvi|) (the latter together with Fact [UJvj) for handling the additional condition 
on D), 

I{P{Z):Z\D) > q l I{P l {Z):Z\D) + q 2 I{P 2 {Z):Z\D) 

> qxI(Px(Z) : Z ltl | D) + q 2 I{P 2 {Z) : Z %x \ D). 

Furthermore, due to the fact that Zn conditioned on = 3 — z is the fixed 
bit 0, IiP^-.Z^lD) = (l/2)I(Pi(Z) : Z iA I D = i). For i = 1,2 let Vi = 
HPiiZ) : Zn j D — i). Altogether, we have shown that 

I{P{Z):Z\D) > ±( qiVl + q2V2 ). (1) 

Our goal is to lower bound the right hand side in terms of the error probability of the 
protocol P. 

We analyze 771 = I(Pi(Z) : Z\ t \ \ D — 1) in detail. Observe that, conditioned on D = 1, 
P\{Z) = Pi(Zi j i,0) and Z\,\ is a uniformly random bit. We also run P\ on the fixed 
(non-random) input (61,62) £ {0, l} 2 , which means that, according to our conventions, 
the players Alice and Bob prepare states w2, z VPz\ z )\ z )) anc ^ \^2)\b 2 ), resp. The 

first two parts of each state correspond to the regular input register and its secret register. 
The second two parts of Alice's state are the contents of the public random coin register 
and its secret register, where (p z ) z is the distribution of the values for the random coins. 
Let 62)) be the final computational state of Pi on input {pi,b 2 ) G {0, l} 2 , before 

tracing out any register. It is obvious that this is a pure state. 

Let Alice 's extended input register be the joint register consisting of Alice's input reg- 
ister, the public random coin register, and the respective secret registers. Let P{(bi,b 2 ) 
be the state obtained from |si(6i,6 2 )) by tracing out Alice's extended input regis- 
ter. In general, the obtained state is mixed due to the random coin component. We 
may regard the states |si(00)), |si(10)) as purifications of the states P[(00), Pj'(lO), 
resp., where the Hilbert space of Alice's extended input register serves as the exten- 
sion space. Since conditioned on D = 1, Bob's part of Z is the fixed input 0, we have 
I{P[{Z) : Z 1A I D = 1) = I{P X {Z) : Z 1A \D = 1). 
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Now we apply the local transition lemma (Lemma EJ) to the states po = -fi(OO) and 
pi = P{(10) and their purifications |si (00)) and | si (10)) , resp. Observe that P[(Z \ D = 
1) = P[(Zx t i, 0) = (1/2)(P 1 '(00) +P 1 / (10)). Due to the lemma, there is a unitary correction 
transformation V acting nontrivially only on the Hilbert space of Alice's extended input 
register such that 

||y|si(00))-|si(10)>|| t < ^HPi(Z):Z 1A \D = l) = 2y^, 

where for the sake of readability, pure states are only written as vectors. Let U(z) be 
the unitary transformation applied by Bob in the protocol P\ if his input bit is z. Then, 
by the unitary invariance of the trace norm and the fact that U(z), z G {0, 1}, and V 
commute: 

||V|si(01)) - |sa(ll)>|| t = \\VU(l)U(0y\ Sl (00)) - C/(l)C/(0)t| Sl (10))|| t 

= ||V| Sl (00))-| Sl (10))|| t < 2v^. 

As abbreviations, let |4(00)) = V|si(00)) and |4(01)) = V>i(01)). Observe that 
(4(01) | Sl (ll)) = ( Sl (Ol)|0| Sl( n)) 

= (s 1 (00)|f/(0)f/(l) t V t ■ f7(l)Z7(0) t |si(10)> 
= (ai(00)| ai (10)>. 

Using the relationship between fidelity and trace distance for pure states from Fact E1JIJ) 
and setting 7! = 2rji as an abbreviation, it follows that 

F(K(01)),| Sl (ll))) = F(K(00)),| Sl (10))) > y/1 - 2 Vl > 1-71- (2) 

We treat the subprotocol Pi in the same way. Notice that the input of Pi is also 
Z = (Zi,Z 2 ), but now Alice has Z 2 and Bob has Z%. Conditioned on D = 2, Z 2 is 
a random bit and Z\ = 0. Let |s2(&i, 62)) be the final computational state of P 2 on input 
(61, b 2 ) G {0, l} 2 (before tracing out any register). Again, this is a pure state. Let |s 2 (00)) 
and |s' 2 (01)) be the states resulting from the application of a correction transformation 
according to the local transition lemma. Let 72 = 2rj 2 . Then, analogously to the above, 
(4(10) I s 2 (ll)) = (s 2 (00) I s 2 (01)) and 

F(|4(10)),h(ll))) = F(|4(00)),|5 2 (01))) > 1-72. (3) 

We still have to connect the local information about the subprotocols that we have just 
derived to the global behavior of the protocol P in order to exploit the fact that P com- 
putes AND with small error probability. For this, we first relate the distances of the states 
for the subprotocols to those for the whole protocol. Let |s(00)) = ai|s^(00))+Q; 2 |s 2 (00)), 
|s(01)) = 0^14(01)) + a 2 |s 2 (01)), |s(10)) = ai|si(10)) + a 2 |4(10)), and |s(ll)> = 
ai|si(ll)) + Q!2|s2(ll)). Then, using that Pi and P2 work on orthogonal subspaces and 
the definitions |«i| 2 = qi, |«2| 2 = q 2 , we get 

(401) I 411)) = gi(4(01) I si(ll)) + q 2 (s 2 (0l) I 5 2 (11)), (4) 
(410) I 411)) = gi( Sl (10) I Sl (ll)> + ?2 (4(10) I s 2 (ll)), and (5) 
(400) I 411)) = ^(4(00) I Sl (ll)) + 92(4(00) I s 2 (ll)). (6) 
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Second, we relate the absolute value of the left hand sides of equations (JH)-©, i. e., the 
fidelity of the respective pairs of states, to the error probability of the protocol P. Let 
p be a quantum state over the Hilbert space of the computational states of P and let 
t r non-work(p) denote the state obtained from p by tracing out the input registers of both 
players, the random coin register, and the respective secret registers. Since the correction 
transformations only work on Alice's extended input register or on Bob's extended input 
register, their effect disappears after applying tr non _ wor k. Hence, for (61,62) £ {0, l} 2 , 

tr n on-work(|s(&l,&2))(s(&l,& 2 )|) = P{h,b 2 ). 

Furthermore, the qubit measured to get the output of the protocol does not belong to the 
bits traced out in this way. We can thus apply Fact 1311111) to get F(|s(01)), |s(11))) < 8 for 
5 = 2-y/e(l — e), where e is the error probability of P. Analogously, F(|s(10)), | s ( 1 1 ) )) < 
5 and F(|s(00)), < 5. 

Third, we prove the desired relationship between error probability and information about 
the inputs stored in the subprotocols. Here it is crucial that the considered state vectors 
only have real components. 

Claim. Let r > and suppose that 5 < 1 — (qiji + ^272) — (3/2)(l/2 + r). 

1. Suppose that there is ani 6 {1, 2} such that qi > 1/2 + r. Then 5 > 2r — (1/2 + r)^. 

2. Let gi ,q 2 E [1/2- r, 1/2 + r]. 

2.1. Suppose that both terms on the right hand side of equation (Op or |£j) ; resp., have 
the same sign. Then 5 > (1/2 — r)(l — 71) or 5 > (1/2 — r)(l — 72), resp. 

2.2. Otherwise, 8 > 1/5 - (4/5)(q 1 ^ 1 + g 2 72)- 

Proof. Case 1: W. 1. o. g., q\ > 1/2 + r and thus g 2 < 1/2 — r - By equation (HJ) and the 
lower bound on the fidelity from (J2J), 

5 > F(| S (01)),|s(ll))) > g 1 |( S / 1 (01)| Sl (ll))|-g2Ks2(01)| S2 (ll))| 
> q 1 F(\s' 1 (01)),\s 1 (ll)))-q 2 > g 1 (l_ 7l )_g 2 > 2r - (1/2 + r) 7l . 

Case 2.1: Let, e.g., equation (jlj) have solely nonnegative terms on its right hand side. 
Then 

5 > F(|s(01)),Kll))) = g 1 |( S / 1 (01)| Sl (ll))| + g 2 Ks2(01)| S 2(ll))| 
> gi(l-Ti) > (l/2-r)(l- 7l ). 

Case 2.2: This is split into two further subcases handling the different possible signs of 
the inner products in equations (HJ) and (jSJ). 

Case 2.2.1: Suppose first that the first terms on the right hand sides of equation (j3| 
and (0) have the same sign. Then due to the case distinction, the second terms have the 
respective opposite sign. We assume that (s'^Ol) | si(ll)) > and (si(10) | Si(ll)) > 
(the other case, (^(01) | si(ll)) < and (si(10) | si(ll)) < 0, is handled analogously). 
We claim that then both inner products on the right hand side of equation (jHJ) are 
nonnegative and of large absolute value. Using the weak inverse triangle inequality for 
inner products of real vectors (Proposition Q), we get 

(si(00) I si(ll)) > 2((s' 1 (00) I si(10)) + ( Sl (10) I Sl (ll))) - 3. (*) 
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(If treating the case that (4(01) | si(ll)) < and (si(10) | Si(ll)) < 0, apply the inverse 
triangle inequality to the vectors (00)) , — | si (10)) , and |si(ll)) and otherwise proceed 
in the same way as described here.) Due to the lower bound on the fidelity from (j2J and 
since (si (01) | si(ll)) > 0, 

(4(00)1^(10)) = (si(01)| Sl (ll)) > l-7i- 

Furthermore, using that (si(10) | si(ll)) > 0, (4(10) | 52(H)) < 0, and equation (jHJ), we 
get 

|( Sl (10)| Sl (ll))| = ( fll (10)| ai (ll)) > -(q 2 \(s' 2 (10)\s 2 (ll))\-8), 

qi 

which together with the lower bound on the fidelity from fact Q implies 

|( Sl (10)| Sl (ll))| > ^{l- l2 )-U. 

qi qi 

Substituting this into (J*j) yields 

(4(00) I si(ll)) > 2(1-^ + ^(1-^) --5) -3 = -(l-(gi7i + g 2 7 2 )-5) -3. 

Next we apply the inverse triangle inequality to the vectors Is^OO)) , — |s2(01)), and 
|s 2 (ll)). Recall that in the considered case, (s 2 (01) | s 2 (ll)) < and (4(10) | s 2 (ll)) = 
(4(00) I s 2 (01)) < 0. Analogously to the calculations above, we get 

(4(00) I s 2 (ll)) > 2(-(4(00)|s 2 (01)) + (-(s 2 (01)|s 2 (ll))))-3 

V v ' " v ' 

> 1-72 > 2l(l_ 7l )_i5 

2 

= — (l - (gi7i + g 2 72) - 6) - 3. 

<?2 

By the derived estimates and the fact that 

S < 1 - [qij! + g 2 72) - 2 (5 + r ) ^ 1 ~ (?i7l + 9272) - ^ max{g 1; q 2 ) 

due to the hypothesis of the claim, the inner products (4(00) | si(ll)) and (4(00) | s 2 (ll)) 
are both nonnegative. Hence, using equation (jHJ) we obtain 

S > gi|(4(00)| Sl (ll))| + g 2 |(4(00)| S2 (ll))| 

> 4(l — (gi7i + ^272) — 5) — 3, and solving for 5, 

1 4 , 
> - - -(9171 + 9272)- 

This completes the proof for Case 2.2.1. 

Case 2.2.2: In the last remaining case, the first terms on the right hand side of 
equation (HJ) and © have opposite sign. W. l.o.g., let (4(01) | si(ll)) > and 
(si(10) I Si(ll)) < 0. We claim that then both inner products on the right hand side 
of equation (0) are nonpositive and of large absolute value. Applying the weak inverse 
triangle inequality for inner products to the vectors |4(00)), |si(10)), — |si(ll)) and to 
the vectors |s' 2 (00)), |s 2 (01)), — |s 2 (H)), resp., yields 

-(4(00)| Sl (ll)) > 2((4(00)|s 1 (10)) + (-(s 1 (10)|s 1 (ll))))-3 and 
-(4(00) I s a (ll)) > 2((4(00) I s 2 (01)) + (-(s 2 (01) I s a (ll)))) - 3, resp. 
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Using arguments analogous to case 2.2.1, the right hand sides of these inequalities can be 
lower bounded by nonnegative expressions in 71,72,5. The ensuing calculations are also 
analogous to the above ones, giving the same lower bound on 5 in terms of 71, 72. □ 

Finally, it only remains to exploit the bounds on 5 in terms of 71,72 due to the claim 
to get bounds on the information cost of the whole protocol. We split the computation 
into cases as in the claim. Due to equation and taking into account that rji = ji/2 
for i = 1,2, we have 

i(P(z)-.z\D) > ^(qiT]i + q2m) = j{qiii + q2i2)- 

For the following case distinction, we assume that the hypothesis of the claim, 5 < 
1 - (<?i7i + 9272) - (3/2) (1/2 + r), is satisfied. 

Case 1: Again, we only consider the subcase q\ > 1/2 + r. Due to the claim, 5 > 
2r - (1/2 + r)7i, implying 71 > (1/2 + r)" 1 (2r - 5). Thus, using that q x > 1/2 + r, 

I{P{Z):Z\D) > \q llx > \(l + r)(\ + ry\2r-5) = \r - \s. (7) 

Case 2.1: W.l.o.g., let 5> (1/2 - r)(l - 7l ) by the claim, i.e., 71 > 1 - (1/2 - t)~ 1 8. 
Then, using that q\ > 1/2 — r in this case, 

I(P ( Z) :Z\D)> i 9l7l > i (i - r) (l - (\ - r^s) = i - \r - \s. (8) 



Case 2.2: We have 5 > 1/5 — (4/5)(gi7i + ^272) by the claim, i.e., gi7i + ^272 > 
1/4- (5/4)5. Then 

KP(Z):Z\D) > \(q lll + q 2l2 ) > \ (\ - = 1 - ^5. (9) 



We still have to take the upper bound on 5 needed for the application of the claim into 
account. This requires that 

3 n 



6 < 1- (gi7i + 9272) - 2 (2 + r ) • 



Since I(P(Z) :Z\D) > (l/4)(gi7i + (7272), the above is satisfied if 

I(P(Z):Z\D) < —--T--5. 
v v > 1 1 - 16 8 4 

Now either the assumption of the lemma is not satisfied and negating the last inequality 
gives us the lower bound 

I(P(Z):Z\D) > -L-jjr-Itf, (10) 
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or we get the minimum of ([IlH© as a lower bound. It remains to fix r such that we get 
a positive lower bound on the information for the largest possible 5. 

We choose r = 1/14 and assume that 5 < 1/7. Then either (fT0|) is satisfied and thus 
I(P(Z) : Z \D) > 1/28 — (1/4)5, or the claim is applicable and a lower bound is given by 
the minimum of ((Zj)-©, 



mm 



128 4 ' 28 4 ' 16 16 / 



The last term in the minimum is smaller than the first one only if 5 > 3/7. Since we have 
assumed that 5 < 1/7, we again get the lower bound I(P(Z) : Z | D) > 1/28 — (1/4)5. 

Altogether, we have shown that for 5 < 1/7, 

I(P(Z):Z\D) > i-itf. 

The claim on the range of the error probabilities in the theorem follows by substituting 
5 = 2y/e(l-e) into the bound 5 < 1/7. □ 



4.4. Application to Quantum Read-Once BPs for the Disjointness Function 

It is convenient here to work with the negation of DIS J n , i. e., the non-disjointness function 
defined by ND n (x, y) = x\y\ V • ■ ■ V x n y n . We consider the same input distribution for 
ND n as in [UEIj- Let D and Z be random variables as defined for AND in the previous 
subsection. Let D = (Di, . . . , D n ) and Z = (Z%, . . . , Z n ) consist of n independent copies of 
D and Z, resp. For i = 1, . . . , n let Z% = (Zi,i, Zip)- Observe that, for any value d that D 
can attain and for each i = 1, . . . ,n, the random variables Z^i, Z^ are independent when 
conditioned on D = d. Furthermore, if for any i G {1, . . . , n} and any (a, b) G {0, l} 2 
we let Z' be the modified input obtained from Z by replacing Z, t with (a, b), we observe 
that, with probability 1, ND n (Z') = AND(a, b). 

Call a quantum read-once BP regular if it reads each of its variables at least once, i.e., 
on each of its paths each variable occurs exactly once. Observe that, in particular, this 
means that such a graph is leveled. For a regular quantum read-once BP G and an 
input z of length n, let G(z) denote the final quantum state computed by G on z after n 
computation steps, before the measurement at the sinks occurs. Observe that G(z) is a 
pure state by the definition of QBPs. Using Fact|2J we get: 

Proposition 4. Let G be a regular quantum read-once BP and let Z be a classical random 
variable describing an input of P. Then I(G(Z) : Z) = S(G(Z)) < log|G|. 

The next lemma describes how a regular quantum read-once BP for ND ra can be used for 
computing the AND of any pair of input variables Xj, of ND n . 

Lemma 7. Let G be a regular e- error quantum read-once BP forND n . Let i G {1, . . . , n} 

and let a pair of assignments (a,b) to the variable vectors (xj)j# and (yj)j&, resp., be 
given such that AND(aj,bj) = for all j ^ i. Then there is an e-error quantum 2- 
partition protocol P a ^ for AND on Xi, yi that does not use its public random coin register 
and has the property that for each input assignment (c, d) its result state P a ,b{b, c) agrees 
with the final state G(a, b, c, d) of G on (a, b, c, d) . 
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In the proof of the lemma, we consider quantum read-once BPs with unlabeled nodes 
obtained by setting variables to constants as follows. Given a quantum read-once BP G 
and a partial assignment a to some of the variables of G, for each node with a variable 
fixed by a we remove the variable label, remove all outgoing edges that are inconsistent 
with a, and remove all boolean labels from the remaining edges. Then the resulting graph 
has the same number of nodes as G and still has a well-defined semantics by the remarks 
in Section El 

We prepare the proof of the lemma by describing the modifications of the given quantum 
BP required for the construction of the desired communication protocol in advance. Let 
G' be the quantum read-once BP containing unlabeled nodes obtained from the given 
graph G according to the hypothesis of the lemma by replacing variables with constants 
according to (a, b). Observe that due to the fact that each variable is read exactly once 
in G, on each path from the source to a sink in G' each of the two variables x^ and yi 
occurs exactly once as the label of a node. Furthermore, each node labeled by a variable 
is either the first such node on all paths reaching it or the second. Let S x and S y be 
the sets of nodes labeled by Xi and y i: resp., where this is the first variable on each path 
reaching the node. Let S = S X U S y . Let T x and T y be the sets of immediate successors 
of nodes labeled by an X{- or a ^-variable, resp., for which this is the second variable on 
each path reaching it. Let T = T x U T y . To avoid tedious case distinctions, we assume 
w. 1. o. g. that S x ^ and S y ^ 0. In particular, this implies that the source is unlabeled. 
Otherwise, it is easy to use the ideas described in the following to define a quantum 
1-partition communication protocol with the required properties. 

Furthermore, for any node v in G', let d SOVLrce (v) and c? sin k s (f) denote the number of edges 
on each path from the source to v and the number of edges on each path from v to a 
sink, resp. Each of this is well-defined due to the fact that in the original graph G each 
variable occurs exactly once on each path. The graph G' has the following properties: 

• The sets S = S X U S y and T = T x U T y form cuts in G', i. e., each path from the source 
to a sink runs through exactly one node from each set, and all nodes on paths from 
the source to S (excluding the latter) and from T to the sinks (including the former) 
are unlabeled nodes. 

• We have S x n S y = and T x fl T y = (the latter due to the unidirectionality of G' 
inherited from G). Furthermore, all paths starting in S x lead to T y and all paths 
starting in S y lead to T x and the sets of nodes on the paths of these two types are 
disjoint (for the nodes not in S U T, this follows from the read-once property of G' 
inherited from G). 

We use these properties to partition the nodes of G' into four subsets: 

• The top part, including all nodes reached by paths from the source to a node in S, 
excluding the latter; 

• two middle parts that consist of all nodes on paths from S x to T y and from S y to T x , 
resp.; and 

• a bottom part with all nodes on paths starting at a node in T and leading to a sink, 
excluding the former and including the latter. 
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Next we further simplify the structure of G', which gives us a new quantum read-once 
BP with unlabeled nodes. Our aim is to ensure that all first nodes in the new middle 
parts lie on a single level and the same for all last nodes in the new middle parts. 

Changes in the top part: First, we replace the top part of G' and extend the middle 
parts upwards. For each node v G S let a v be the amplitude for reaching it from the 
source (i. e., the sum over all paths of the products of the amplitudes at the edges of these 
paths). Remove the top part of G 1 . For each v G S, add a chain of d sourcc (v) — 1 > 
new unlabeled dummy nodes, where a single outgoing edge without boolean label and 
with amplitude 1 leads to the next dummy node in the chain for the first d somce (v ) — 2 
nodes and to v for the last dummy node in the chain. Add a new unlabeled source with 
outgoing edges that have no boolean label and that lead to the sources of the chains of 
dummy nodes. The edge leading to the chain of dummy nodes for node v is labeled with 
amplitude a v . 

Changes in the bottom part: For a node v G T and a sink w, let /3 VjW be the amplitude 
for reaching w from v. Remove the bottom part except for the sinks. Also remove each 
node v G T and redirect all incoming edges to the first node in a chain of new unlabeled 
dummy nodes of length d s ink s (^)+l > 1- The first dsinks^) nodes of this chain have a single 
outgoing edge with amplitude 1 leading to the next node in the chain. Furthermore, for 
each sink w that has been reachable from v in G' add an edge leading from the last node 
in the chain of dummy nodes to w with amplitude /3 V>W . Observe that this construction 
increases the length of all computation paths by 1. This ensures that the nodes at the 
ends of the chains of dummy nodes, which play the role of those in T in the new graph, 
are separated from the sinks, and thus avoids unwanted case distinctions. 

Call the resulting graph G" . We state the key properties of G" in form of the following 
lemma. 

Lemma 8. The graph G" is a legal quantum read-once BP with unlabeled nodes. Fur- 
thermore, for any input assignment (c, d) to (xj, yi) the final state ofG" on the input (c, d) 
agrees with that of G' and thus also with that of G on the input (a, b, c, d). In particular, 
G" computes the AND of Xi and yi with the error bound e of G. 

Proof. We prove that the changes that turn G' into G" retain well-formedness, unidirec- 
tionality, and the transformation computed by the graph as a QBP. We consider the top 
part and the bottom part of G' separately. 

Changes in the top part: We first introduce some notation. Number the levels of G' from 
(the level of the source) to 2n (the level of the sinks). Let L e be the set of nodes on 
level i. For any subset of nodes A C Li let A = Li — A. Let l\ < ■ ■ ■ < £k be the levels 
of G' that contain nodes from S (recall that these are the first nodes on paths in G' that 
are labeled by a variable). Let £q — 1 < l\. 

Observe that the nodes on level t with < t < £k can be classified as follows: (i) nodes 
in S, i. e., nodes that are labeled by a variable and that are reachable only by paths that 
solely contain unlabeled nodes; (ii) unlabeled nodes that are reached only by paths that 
solely contain unlabeled nodes; (iii) unlabeled nodes v with the property that a node in S 
lies on each path from the source to v. Let Vs(£), Vu(£), resp., be the sets of nodes of the 
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first two types on level £. For levels £, £' with £ < £' and any sets of nodes A C L e and 
B C ip, where B contains all nodes reachable from A and no nodes reachable from A, 
let Ua,b be the transformation that acts on the basis vectors of nodes in A as described 
by the subgraph of G' consisting of all paths from A to B and as the identity on all basis 
vectors of nodes in A (due to the well-formedness of G', this can be extended to a unitary 
transformation). For <£<£'< 2n we use the abbreviation U^y = Ul^l^- 

We describe the insertion of the chains of dummy nodes, called dummy chains in the 
following, as an inductive process. The above definitions of the sets of nodes are meant 
to refer to the actual graph after the modifications carried out so far. In induction step i, 
i = k — 1, k — 2, . . . , 0, we modify the levels £i — l,£i . . . , £i+\. The aim is to replace the 
unlabeled nodes in the top part of G' between levels £^ and £ i+ i by dummy chains and 
to modify the transformation between levels £{ — \ and £ { to maintain the correct overall 
transformation of the graph. 

We choose W" = V s (£i+i) U Vu(£ i+1 ) as the set of the end nodes of the new dummy 
chains. The set Vu(£i + i) is empty for % = k — 1 and contains the start nodes of all 
already constructed dummy chains for % < k — 2). We observe that the nodes on level £i 
from which nodes in W" are reachable are precisely those in W = Vu(£i)- The immediate 
predecessors of W are the nodes in W = Vu(£i — 1). Furthermore, the set X = W'UVs(£i) 
contains all nodes reachable from W. Finally, note that the transformations U WjX and 
Uw',w" are well-defined. 

Now step i of the inductive construction is done as follows: 

• Remove all nodes and edges on paths from W to W", excluding the start and end 
nodes. 

• For each node in W", insert a chain of new dummy nodes from level £i to that node. 
Let W denote the set of start nodes of these chains on level £{ and let Tw",w be the 
linear extension of the bijection that maps the basis states belonging to W" to those 
belonging to W. 

• Change the edges between W and X such that the transformation U\y,x realized before 
by these edges is replaced with the transformation ,w'Uw' ,w"Uw,x- 

Assuming that the given graph is well-formed and unidirectional, these steps can be car- 
ried out such that this is still true for the resulting graph. We claim that the modifications 
do not change the transformation realized by the graph if interpreted as a QBP. We only 
need to consider the transformations realized between the modified levels. 

Originally, we have 

E^i-Mi+i = Uw^w'Uy^ ^m ■ U w ,xU W x- 

Let X = W U Vs(£i) and denote the transformations in the modified graph between 
sets A and B by Ua,b- Then, by the construction, Uw,x = T w » ,w'Uw' ,w"Uw,x and 
Uw',w" — T^n yy,. Hence, 

— T w ), yyliyyyv 71 ' Tw>',w>Uw',w>'Uw,xMw,x- 
Since U^^n commutes with both T^), w , and Uw',w" due to the disjointness of the 
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respective sets of nodes, we get 



Ue^iA+i - Uw\w''Uw,W T7 Uw,xUw j x- 

Since the changes do not affect the transformations from W to X = X and from W = 
W to W", the right hand side above is equal to the original transformation Ue z ~i : e i+1 . 
Altogether, the graph that we obtain by carrying out all inductive steps is still well- 
formed and unidirectional and computes the same transformation as G'. It is easy to 
see that this is exactly the graph obtained by the modification of the top part described 
before the lemma. 

Changes in the bottom part: For simplicity, we first insert a level of unlabeled dummy 
nodes directly above the sinks such that each sink has a corresponding dummy node in 
this new level which obtains its incoming edges and from which it is reached by an edge 
labeled with amplitude 1. This ensures that the set T of direct successors of nodes that 
are the second ones on each path labeled by a variable is disjoint from the sinks in the 
new graph. The rest of the proof for the bottom part is now analogous to that for the 
top part if we look at the graph turned upside down and exchange the level of the source 
with that of the sinks and the set S with the set T. □ 

We partition the set of nodes of G" analogously to that of G. The top part of G" consists 
of the source, the bottom part consists of the sinks, and the two middle parts consist of 
the nodes in the middle parts of G' together with the dummy nodes on the chains added 
to the respective parts. 

Overloading notation, we reuse S, S x , S y and T, T x , T y to denote the sets of start and end 
nodes, resp., in the new middle parts of G" analogous to the respective sets in G' . For any 
node v and any assignment z G {0, l} 2 to (xj,yj), let \ip v ^(z)) denote the superposition 
of basis states belonging to the nodes on level t of G" computed by G" on input z when 
starting from the basis state belonging to v. For the construction of the desired quantum 
2-partition protocol, we need the following property of G", which we prove in advance. 

Lemma 9. Let v\ G S x , v 2 G S y and let Zi,z 2 G {0, l} 2 be any assignments to (xi,yi). 
Then for any level £ & {1, . . . , 2n + 1} (where the source is on level and the sinks are 
on level 2n + l), the states \ip vi /(zi)) and \ip V2 /(z 2 )) are orthogonal. 

Proof. The claim is obviously true for all levels t G {1, . . . , 2n}, since the sets of nodes 
in the respective superpositions \ip Vl /(z 1 )) and \ip V2t e(z 2 )) are disjoint. We have to verify 
the claim for the level i = 2n + 1 of the sinks. 

Let U be a unitary extension of the transformation realized by the edges between the 
last level 2n of G" above the sinks and level 2n + 1. Since the last level above the sinks 
only contains unlabeled nodes, U does not depend on the input. Thus, \i/) Vi ,2n+i(zi)) = 
U\ip Vit 2n{zi)) for i = l,2 and we get 

(lpv 1: 2n+l(zi) I fpv 2 ,2n+l(z2)) = (^i,2n(^l) \U ] U \lp V2 t2n {.Z 2 )) 

= {lp Vl ,2n(zi) | ^v 2 ,2n{z2)) = 0. 

□ 
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Proof of Lemma\2\ We construct the quantum 2-partition protocol P = P a ^ using the 
graph G" . We make sure that P simulates G" . 

For v G S = S x U S y , let a v be the amplitude for reaching v from the source of G". The 
protocol P works on the space spanned by the basis vectors belonging to the nodes in the 
middle parts and in the bottom part of G" . It has subprotocols P x and P y with respect 
to the variable partitions ({xj}, {yi}) and ({yi}, {xi}), resp. Let q x = J2 veSx \ct v \ 2 and 
q y = J2ves y \ a v\ 2 - The initial amplitudes of P x and P y are defined as ^[q x ~ and y/q~y~, resp. 
As the initial state \s x ) of P x we choose ^ veS {&v/ >/Qx)\ v ) if Qx an d some arbitrary 
\v) with v E S x if q x = 0. Define \s v ) analogously for P y . 

We only describe the computation of P x in detail, P y works in the same way We first 
define further subprotocols P X)V belonging to each of the nodes v G S x . Let G" be the 
subgraph of G" with source v G S x containing all nodes reachable from v. On each path 
starting at a node v G S x there is exactly one t/j-node. There is some level m where 
the first 2/j-node in G" is read. In P x >v the player Alice simulates the computation of G" 
starting at v and until level m. She sends the reached superposition of basis states of nodes 
on level m to Bob. Bob continues the simulation of G" starting with the superposition 
received from Alice and computing a superposition of the sinks in G". Let P x be the 
protocol where the described subprotocols P XjV , v G S x , are applied to the initial state 
of P x , 

We claim that P x designed in this way is a legal quantum one-way protocol. The state 
obtained after Alice has finished her computation in P x need not be reachable by any 
computation in G" . Nevertheless, it is a legal pure quantum state by the following 
argument. Let S xm C S x be the set of all nodes v for which m is the first level with 
?/i-nodes reached from v in G" v . Let A v be the unitary transformation applied by Alice 
in P X}V . Then the state computed by Alice according to P x is = J2 v es a vA v \v) and 
we have 

{ip\ip)= 2J a* v a v < (v\AlA v ,\v') = 2J ^ a v a v {v\A\A vl \v') 

v,v'£S x m v,v'£S x , m 

= E E \ a -\ 2 = L 

The second equality is due to the fact that the subspaces induced by the nodes on 
different levels of G" are orthogonal. The third equality follows from the unitarity of the 
time evolution of G" . Due to the same fact, also Bob's transformation in P x is unitary. 

Finally, due to Lemma El the state spaces of P x and P y constructed in the above way 
are orthogonal. Hence, putting these protocols together as described before gives a legal 
quantum 2-partition protocol P. It is obvious that P simulates G" and thus its result 
state also agrees with the final state of G. □ 

We are now ready to prove the main theorem. 

Proof of Theorem^ Let G be a regular e-error quantum read-once BP for ND n . We 
run G on the random input Z conditioned on D — d. Since Z = (Zi,...,Z n ), 
where Z\,...,Z n are independent, Fact ITl|vii|) (superadditivity of mutual information), 
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Fact llT|vj) . and Proposition 0] yield 

n 

^2l(G{Z) -.Z^D) < I{G{Z):Z\D) =^Pr{/3 = d} ■ I(G{Z) : Z \D = d) < \og\G\. 

i=l d 

Hence, by averaging, we can fix an i such that 

I(G(Z) :Zi\D) < (log|G|)/n. 

Let D = (D^i,Di), where Z)_j = (Dj)^. Then again by averaging and FactHJJvj), there 
is a value d-i for _D_j such that 

I{G(Z):Z i \D- i = d[- i ,D i ) < (log|G|)/n. 

To prove the claim, we lower bound the term on the left hand side of this inequality by 
the information cost of an e-error quantum 2-partition protocol for AND on input Zi 
conditioned on Di. Then using the constant lower bound on the information cost from 
Theorem Eland the above inequality, we get that (log \G\)/n = fi(l) and thus \G\ = 2 n(jl \ 
which proves the theorem. 

For the following, let d be any fixed value for Di. Let Z^ = (Z±,...,Zn} be a 
random variable that is distributed as Z conditioned on D_i = d_i and Di = d. Let 
Z^l = {Zj F° r eacn fixed value £_j in the support of Z_}, we get an e-error 

quantum 2-partition protocol t for AND on the input Zi = (xi,yi) by Lemma [7| This 
protocol does not use its public random coin register. Furthermore, the result state of P^_ t 
on Zi agrees with the final state G(z-i, Zi) of G. Let Q be a quantum 2-partition protocol 
in which the players run P?_. for z_i chosen randomly with the distribution of Z_i under 
the condition = cT_j. They can do this by initializing the public random coin register 
and the secret part of this register appropriately according to our conventions. Then the 
result state of Q after trace-out of the input registers of both players, the random coin 
register, and the secret registers is Q(zi) = Ps(d)(zi). 

— i 

Now Q is run on the random input Z^ by using the secret input registers of Alice and 
Bob (at this point, we exploit the fact that the input bits of Alice and Bob under the 
condition Di = d are independent of each other). Expanding the abbreviations and using 
the fact that Pg_X z i) = z i) f° r & H {z-h z i)i we g e ^ : 

l(Q{z\ d) ):Z ( f ) ) = I(Q(Z i ):Z l \D i = d) = I \P^ JZ>) : Z t \ D^ = d_ u D t = d) 

= l(G(Z):Z i \D- i = d- i ,D i = d). 

Averaging over all values d yields 

lC(Q;Zi\Di) = I{Q{Zi):Zi\Di) = l(G(Z):Z i \D^ = d- i ,D i ). 

Since for the vector Z' obtained from Z by replacing Zi with any Zi G {0, l} 2 , 
ND n (Z') = AND(zj) with probability 1, we know that Q is an e-error quantum 2- 
partition protocol for AND. By the lower bound on the information cost of quantum 
multi-partition protocols for AND from Theorem El it follows that the left hand side of 
the above inequality is lower bounded by a positive constant. Together with our above 
arguments, this completes the proof. □ 
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